Skip to content
Alchemy
GitHubXDiscordRSS

Cloudflare Auth

There are three supported ways of authorizing Alchemy with Cloudflare:

  1. OAuth (recommended) - short-lived access and refresh tokens
  2. API Token - a token you create once with limited scopes
  3. Global API Key (legacy) - the global, highly permissive API key

OAuth

Section titled “OAuth”

To use OAuth with Cloudflare, create a Profile with alchemy configure and select OAuth for Cloudflare.

Once setup, you can refresh your OAuth tokens with Cloudflare using the alchemy login command:

Terminal window
bun alchemy login [--profile <profile>]

Then, deploy your app with alchemy deploy (or run another CLI command):

Terminal window
bun alchemy deploy

To select a specific profile, use the --profile flag:

Terminal window
bun alchemy deploy --profile <profile>

API Token

Section titled “API Token”

First, create an API Token and then use it in your Alchemy app.

By default, Alchemy will use the CLOUDFLARE_API_TOKEN environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_TOKEN=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_TOKEN=<token> bun alchemy deploy

You can explciitly set an apiToken when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiToken: alchemy.secret(process.env.MY_TOKEN)
});

Global API Key

Section titled “Global API Key”

After you verify your Cloudflare Account’s Email, you will be given a Global API Key.

By default, Alchemy will use the CLOUDFLARE_API_KEY environment variable if set.

You can store the token in your .env file

Terminal window
CLOUDFLARE_API_KEY=<token>

Or set when deploying your app:

Terminal window
CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explciitly set an apiKey when creating a Cloudflare Resource, such as a Worker:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY)
});

Email

Section titled “Email”

When using Global API Keys, Alchemy must be configured with the API Key’s email.

By default, Alchemy will use the CLOUDFLARE_EMAIL if set

Terminal window
CLOUDFLARE_EMAIL=me@example.com CLOUDFLARE_API_KEY=<token> bun alchemy deploy

You can explicitly set email when creating a Cloudlfare Resource:

await Worker("my-worker", {
  apiKey: alchemy.secret(process.env.MY_GLOBAL_KEY),
  email: "me@example.com"
});

Account ID

Section titled “Account ID”

By default, Alchemy will resolve the account ID from the Profile or look it up using your API Key or Token.

Terminal window
# will use wrangler login and resolve the first account you have acces to (ideal for personal accounts)
bun alchemy deploy

You can override the default account ID with the CLOUDFLARE_ACCOUNT_ID environment variable:

Terminal window
CLOUDFLARE_ACCOUNT_ID=<account-id> bun alchemy deploy

Or by setting accountId when creating a Cloudflare Resource:

await Worker("my-worker", {
  accountId: "my-account-id",
});